Arbitrary File Extraction Vulnerability in aimhubio/aim by Aimhub

CVE-2024-6829

Summary

A vulnerability in aimhubio/aim version 3.19.3 enables attackers to exploit the tarfile.extractall() function. By crafting a malicious tarfile, an attacker can manipulate repo.path and run_hash to bypass directory existence checks, allowing the extraction of files to unintended locations on the server. This could overwrite critical files and facilitate further attacks, such as injecting a new SSH key onto the target server, posing a significant security risk.

References